Self-Propagating AI Worm Found in Microsoft Copilot for Word

A security researcher has disclosed, through coordinated disclosure with Microsoft, a cross-domain prompt injection (XPIA) vulnerability class in Copilot for Word that lets attacker-controlled instructions hidden in a document propagate like a worm across trusted document workflows. When a compromised document is used as source material in a Copilot drafting or editing task, the hidden instructions can cause Copilot to silently alter content—such as financial figures—and copy themselves into the newly generated document, turning it into a new carrier that can infect further documents down the line, even without the original malicious file or attacker involvement.

The disclosure followed a 144-day coordination period with Microsoft's product teams and MSRC, extended twice from an initial 90 days. Despite two mitigation attempts, including an upgrade of the underlying model, testing showed the attack still reproduces with the latest model available at publication, prompting the researcher to disclose the vulnerability class rather than withhold it, since no robust fix exists and ordinary document workflows across organizations remain affected.

For engineers and security teams, this shows that AI-assisted productivity tools need explicit trust boundaries between user instructions and content extracted from attached documents—treating externally sourced files as untrusted input rather than authoritative context, and reviewing Copilot-generated output before reuse or distribution.